CVE-2022-27249

An unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to execute arbitrary code by using UploadDwg to upload a crafted aspx file to the web root, and then visiting the URL for this aspx resource.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

4.94% chance of exploitation in the next 30 days, 92th percentile

Published

2022-04-03

Updated

2024-08-03

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/166559/IdeaRE-RefTree-Shell-Upload.html

References

• CVE Record
• NVD entry

Related

• CVE-2022-2724
• CVE-2022-27254
• CVE-2022-2723
• CVE-2022-27255
• CVE-2022-27228
• CVE-2022-27256